WITR(1)

NAME
witr - Why is this running?

SYNOPSIS
witr [process name] [flags]

DESCRIPTION
witr explains why a process or port is running by tracing its ancestry.

OPTIONS
--env[=false]
    show environment variables for the process

-x, --exact[=false]
    use exact name matching (no substring search)

-f, --file=""
    file path to find process for

-h, --help[=false]
    help for witr

-i, --interactive[=false]
    interactive mode (TUI)

--json[=false]
    show result as JSON

--no-color[=false]
    disable colorized output

-p, --pid=""
    pid to look up

-o, --port=""
    port to look up

-s, --short[=false]
    show only ancestry

-t, --tree[=false]
    show only ancestry as a tree

--verbose[=false]
    show extended process information

--warnings[=false]
    show only warnings

EXAMPLE
      # Inspect a running process by name
      witr nginx
      # Look up a process by PID
      witr --pid 1234
      # Find the process listening on a specific port
      witr --port 5432
      # Find the process holding a lock on a file
      witr --file /var/lib/dpkg/lock
      # Inspect a process by name with exact matching (no fuzzy search)
      witr bun --exact
      # Show the full process ancestry (who started whom)
      witr postgres --tree
      # Show only warnings (suspicious env, arguments, parents)
      witr docker --warnings
      # Display only environment variables of the process
      witr node --env
      # Short, single-line output (useful for scripts)
      witr sshd --short
      # Disable colorized output (CI or piping)
      witr redis --no-color
      # Output machine-readable JSON
      witr chrome --json
      # Show extended process information (memory, I/O, file descriptors)
      witr mysql --verbose
      # Combine flags: inspect port, show environment variables, output JSON
      witr --port 8080 --env --json